Choose event display format: factors, details, or raw

By default, the Event column on the Investigation tab contains a factor for the event. The factor view presents selected name-value pairs extracted from the event that identify the purpose and meaning of the event, as described in Factors are derived from an event dictionary.

You can change how a event is displayed. You can select the Details view, which shows all of the name-value pairs that were parsed out of the raw message, or you can view the Raw view, the message itself.

The UI provides two ways to switch the event format, described below.

Change event format for a single event

When you mouse over an event in the Investigation tab a plus sign (+) appears on the left side of the page.

When you click the icon, the event display area expands to show the Details view.

You can click Raw to display the raw message.

Change event format for a one or more events

If you want to change the event format for multiple events, select them using the appropriate multiple-select keyboard shortcuts.

Recommended articles

Sumo Logic is the industry’s leading secure, cloud-native, machine data analytics service, delivering real-time, continuous intelligence across the entire application lifecycle and stack. More than 1,000 customers around the globe rely on Sumo Logic for the analytics and insights to build, run and secure their modern applications and cloud infrastructures.